lockbitchat
414c27fda6
The bundles carried all thirteen translations at once and a page fetched them a third time as raw source; each page now loads only its own language. Alongside that: JavaScript is minified, the eight stylesheets are served as one file, the QR scanner is fetched after the app is up instead of on every visit, Inter ships once rather than five copies of the same file, and Font Awesome is subset to the 82 icons this app draws instead of all 2468. 1.85 MB across 43 requests becomes under 700 KB across 33. On mobile the page starts drawing in 1.6 s instead of 6.3 s and is usable in 4.5 s instead of 11 s. Pages also carry their text in the HTML now. Everything was drawn by JavaScript into an empty div, so crawlers saw correct metadata around nothing, and twelve of the thirteen language pages had never been shown to anyone. The documentation is published under /docs/ with a new FAQ, and unknown addresses return a real 404. Separately: the localized shells were served with the year-long immutable cache header meant for static assets, which pinned anyone who opened /de/ or /ru/ to that build. The header is fixed and the service worker refreshes what it cached. Claude-Session: https://claude.ai/code/session_014KjzTXxrhzYoDDWChYQ4u2
186 lines
12 KiB
HTML
186 lines
12 KiB
HTML
<!DOCTYPE html>
|
|
<!-- Generated by scripts/build-docs.js from doc/*.md. Edits here are overwritten;
|
|
change the Markdown instead. -->
|
|
<html lang="en" dir="ltr">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; upgrade-insecure-requests;">
|
|
<meta http-equiv="X-Content-Type-Options" content="nosniff">
|
|
<meta http-equiv="Referrer-Policy" content="strict-origin-when-cross-origin">
|
|
<title>Use policy and limitations - SecureBit.chat</title>
|
|
<meta name="description" content="SecureBit.chat is open-source software for private communication, research and education. It is provided as is, without warranty of any kind. This…">
|
|
<meta name="robots" content="index, follow, max-image-preview:large, max-snippet:-1">
|
|
<link rel="canonical" href="https://securebit.chat/docs/use-policy/">
|
|
<link rel="icon" type="image/x-icon" href="/logo/favicon.ico">
|
|
<meta property="og:site_name" content="SecureBit.chat">
|
|
<meta property="og:title" content="Use policy and limitations - SecureBit.chat">
|
|
<meta property="og:description" content="SecureBit.chat is open-source software for private communication, research and education. It is provided as is, without warranty of any kind. This…">
|
|
<meta property="og:url" content="https://securebit.chat/docs/use-policy/">
|
|
<meta property="og:type" content="article">
|
|
<meta property="og:locale" content="en_US">
|
|
<meta property="og:image" content="https://securebit.chat/assets/social-card.png">
|
|
<meta name="twitter:card" content="summary_large_image">
|
|
<meta name="twitter:title" content="Use policy and limitations - SecureBit.chat">
|
|
<meta name="twitter:description" content="SecureBit.chat is open-source software for private communication, research and education. It is provided as is, without warranty of any kind. This…">
|
|
<meta name="twitter:image" content="https://securebit.chat/assets/social-card.png">
|
|
<script type="application/ld+json">
|
|
{
|
|
"@context": "https://schema.org",
|
|
"@type": "TechArticle",
|
|
"headline": "Use policy and limitations",
|
|
"description": "SecureBit.chat is open-source software for private communication, research and education. It is provided as is, without warranty of any kind. This…",
|
|
"url": "https://securebit.chat/docs/use-policy/",
|
|
"inLanguage": "en",
|
|
"isPartOf": {
|
|
"@type": "WebSite",
|
|
"@id": "https://securebit.chat/#website"
|
|
},
|
|
"publisher": {
|
|
"@id": "https://securebit.chat/#organization"
|
|
}
|
|
}
|
|
</script>
|
|
<style>
|
|
:root { color-scheme: dark; }
|
|
* { box-sizing: border-box; }
|
|
body {
|
|
margin: 0;
|
|
background: #0f0f11;
|
|
color: #d6d6dc;
|
|
font-family: Inter, system-ui, -apple-system, "Segoe UI", sans-serif;
|
|
font-size: 16px;
|
|
line-height: 1.68;
|
|
}
|
|
.wrap { max-width: 46rem; margin: 0 auto; padding: 28px 24px 90px; }
|
|
.top {
|
|
display: flex; flex-wrap: wrap; gap: 8px 18px; align-items: baseline;
|
|
padding-bottom: 16px; margin-bottom: 40px;
|
|
border-bottom: 1px solid rgba(255,255,255,.08);
|
|
font-size: 13.5px;
|
|
}
|
|
.top a { color: #8a8a92; text-decoration: none; }
|
|
.top a:hover, .top a:focus-visible { color: #f0892a; }
|
|
.top .brand { color: #f0892a; font-weight: 700; letter-spacing: .04em; }
|
|
.top .here { color: #d6d6dc; margin-inline-start: auto; }
|
|
h1 { font-size: clamp(28px, 5vw, 36px); font-weight: 800; letter-spacing: -1px; line-height: 1.14; color: #f4f4f6; margin: 0 0 24px; }
|
|
h2 { font-size: 22px; font-weight: 700; letter-spacing: -.4px; color: #f4f4f6; margin: 46px 0 12px; padding-top: 14px; border-top: 1px solid rgba(255,255,255,.07); }
|
|
h3 { font-size: 17.5px; font-weight: 700; color: #e8e8eb; margin: 30px 0 8px; }
|
|
h4 { font-size: 15.5px; font-weight: 700; color: #e8e8eb; margin: 22px 0 6px; }
|
|
p, li { color: #a9a9b3; }
|
|
p { margin: 0 0 16px; }
|
|
ul, ol { padding-inline-start: 22px; margin: 0 0 16px; }
|
|
li { margin: 5px 0; }
|
|
a { color: #f0892a; text-underline-offset: 2px; }
|
|
strong { color: #e8e8eb; }
|
|
code { font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: .88em; background: #17171c; border: 1px solid rgba(255,255,255,.07); border-radius: 4px; padding: 1px 5px; color: #e8e8eb; }
|
|
pre { background: #0b0b0e; border: 1px solid rgba(255,255,255,.08); border-radius: 8px; padding: 14px 16px; overflow-x: auto; margin: 0 0 18px; }
|
|
pre code { background: none; border: 0; padding: 0; font-size: 13px; line-height: 1.62; color: #c9c9d1; }
|
|
.tablewrap { overflow-x: auto; margin: 0 0 20px; }
|
|
table { border-collapse: collapse; width: 100%; font-size: 14.5px; min-width: 30rem; }
|
|
th { text-align: start; color: #8a8a92; font-weight: 600; font-size: 12px; letter-spacing: .08em; text-transform: uppercase; padding: 0 14px 8px 0; border-bottom: 1px solid rgba(255,255,255,.12); }
|
|
td { padding: 9px 14px 9px 0; border-bottom: 1px solid rgba(255,255,255,.06); vertical-align: top; color: #a9a9b3; }
|
|
td:first-child, th:first-child { padding-inline-start: 0; }
|
|
blockquote { margin: 0 0 18px; padding: 2px 0 2px 16px; border-inline-start: 3px solid rgba(240,137,42,.4); color: #8a8a92; }
|
|
hr { border: 0; border-top: 1px solid rgba(255,255,255,.08); margin: 34px 0; }
|
|
img { max-width: 100%; height: auto; }
|
|
a:focus-visible { outline: 2px solid #f0892a; outline-offset: 2px; border-radius: 2px; }
|
|
.more { margin-top: 64px; padding-top: 22px; border-top: 1px solid rgba(255,255,255,.08); }
|
|
.more h2 { font-size: 13px; letter-spacing: .12em; text-transform: uppercase; color: #6b6b73; border: 0; margin: 0 0 12px; padding: 0; font-weight: 700; }
|
|
.more ul { list-style: none; padding: 0; margin: 0; display: grid; grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr)); gap: 4px 24px; }
|
|
.more li { margin: 0; padding: 7px 0; border-bottom: 1px solid rgba(255,255,255,.05); font-size: 14.5px; }
|
|
@media (prefers-reduced-motion: reduce) { * { animation: none !important; transition: none !important; } }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="wrap">
|
|
<nav class="top">
|
|
<a class="brand" href="/">SecureBit.chat</a>
|
|
<a href="/docs/">Documentation</a>
|
|
<a href="https://github.com/SecureBitChat/securebit-chat" rel="noopener">GitHub</a>
|
|
<span class="here">Use policy and limitations</span>
|
|
</nav>
|
|
<h1>Use policy and limitations</h1>
|
|
<p>SecureBit.chat is open-source software for private communication, research and
|
|
education. It is provided as is, without warranty of any kind. This document sets
|
|
out what the software can and cannot do for you, and what is expected of you when
|
|
you use it.</p>
|
|
<h2 id="what-it-protects">What it protects</h2>
|
|
<p>Message content between two verified peers, against anyone observing or
|
|
manipulating the network between them. That is a real guarantee and it is what
|
|
the design is built around.</p>
|
|
<h2 id="what-it-does-not-protect">What it does not protect</h2>
|
|
<p>Be clear about these before relying on the software for anything that matters.</p>
|
|
<p><strong>A compromised device.</strong> Malware, a hostile browser extension, a keylogger or
|
|
someone with access to an unlocked machine sees your messages as you do. No
|
|
transport encryption helps. This is the most common way private communication is
|
|
actually broken.</p>
|
|
<p><strong>The person you are talking to.</strong> They can screenshot, photograph the screen,
|
|
copy the text, or simply repeat what you said. View-once and disappearing
|
|
messages are cooperative features that a normal client honours; they are not a
|
|
technical restriction on a determined recipient.</p>
|
|
<p><strong>Verification you skipped.</strong> If you do not compare the safety code, or you
|
|
compare it over a channel the attacker controls, the software cannot tell that
|
|
someone is in the middle. The comparison must happen over something an attacker
|
|
cannot impersonate: in person, or a voice you recognise.</p>
|
|
<p><strong>Metadata, depending on your setup.</strong> A direct connection reveals your IP
|
|
address to the peer. Relay-only mode with your own TURN server prevents that, but
|
|
the relay operator can then see both addresses and the timing of traffic, though
|
|
never the content. Choose according to who you are protecting against.</p>
|
|
<p><strong>The fact that you are using it.</strong> Someone watching your network can see a
|
|
WebRTC connection and can see you loading this application. The software does not
|
|
hide its own use.</p>
|
|
<h2 id="your-responsibilities">Your responsibilities</h2>
|
|
<ul>
|
|
<li>Comply with the law where you are and with any policies that apply to you</li>
|
|
<li>Keep your device and browser current and under your control</li>
|
|
<li>Compare the safety code out of band, every time, on every new session</li>
|
|
<li>Configure TURN correctly if you need relay-only mode, and verify it works</li>
|
|
<li>Understand that endpoint compromise defeats everything above the endpoint</li>
|
|
</ul>
|
|
<h2 id="intended-use">Intended use</h2>
|
|
<p>The software is meant for legitimate private communication: journalism and source
|
|
protection, human rights work, business confidentiality, medical and legal
|
|
matters, research and education, and ordinary personal conversation that is
|
|
nobody else's business.</p>
|
|
<p>It is not meant to facilitate unlawful activity, abuse, harassment, exploitation
|
|
or harm, and being able to communicate privately does not make any of those
|
|
acceptable.</p>
|
|
<p>If you become aware of the software being used to harm someone, report it to the
|
|
appropriate authorities. Vulnerabilities in the software itself go to the
|
|
maintainers first: see <a href="https://github.com/SecureBitChat/securebit-chat/blob/main/SECURITY.md">SECURITY.md</a>.</p>
|
|
<h2 id="operational-notes">Operational notes</h2>
|
|
<p>If your threat model is serious, the software is only one part of it.</p>
|
|
<p>Use a device you control and keep it patched. Consider a separate device for
|
|
sensitive conversations. Be aware of who can see your screen and who can hear
|
|
you. Understand that a camera and microphone are attached to the machine you are
|
|
typing on. Consider what your network operator can observe, and whether a VPN or
|
|
Tor changes that in your favour or simply moves the observation point.</p>
|
|
<p>Know the law where you are. Encryption is regulated differently in different
|
|
places, and in some jurisdictions there are disclosure requirements attached to
|
|
it.</p>
|
|
<h2 id="contributing">Contributing</h2>
|
|
<p>Contributions are welcome under the same expectations. Report vulnerabilities
|
|
through the process in <a href="https://github.com/SecureBitChat/securebit-chat/blob/main/SECURITY.md">SECURITY.md</a> rather than publishing them,
|
|
and give a fix reasonable time to reach users before disclosure. Users who have
|
|
not updated yet are the ones exposed by early publication.</p>
|
|
<p>See <a href="/docs/contributing/">CONTRIBUTING.md</a> for the development workflow.</p>
|
|
|
|
<nav class="more">
|
|
<h2>More documentation</h2>
|
|
<ul>
|
|
<li><a href="/docs/">Documentation</a></li>
|
|
<li><a href="/docs/faq/">Frequently asked questions</a></li>
|
|
<li><a href="/docs/architecture/">Architecture</a></li>
|
|
<li><a href="/docs/cryptography/">Cryptography</a></li>
|
|
<li><a href="/docs/descriptor-sbq2/">SBQ2 — connection descriptor v2</a></li>
|
|
<li><a href="/docs/configuration/">Configuration</a></li>
|
|
<li><a href="/docs/calls/">Voice and video calls</a></li>
|
|
<li><a href="/docs/api/">API Notes</a></li>
|
|
<li><a href="/docs/contributing/">Contributing</a></li>
|
|
</ul>
|
|
</nav>
|
|
</div>
|
|
</body>
|
|
</html>
|